Experiences of Trust in Postmortem Profile Management

KATIE Z. GACH, ATLAS Institute, University of Colorado Boulder JED R. BRUBAKER, University of Colorado Boulder 2

In the landscape of online social networking sites, many platforms are reaching a scale and longevity that require designers to address the postmortem data interactions that follow people’s deaths. To evaluate the experiences and challenges people face when caring for memorialized profiles, we conducted 28 qualitative interviews with people serving as legacy contacts for memorialized Facebook accounts. We report on who legacy contacts are and their practices and their expectations, and find that people were chosen to be a legacy contact for one major reason: trust. In our analysis, we find disconnects between how people understand trust in the context of interpersonal relationships and how trust is technically implemented. We conclude by discussing the persistent challenges of representing the ambiguity of interpersonal trust in impersonal, computational systems. CCS Concepts: • Human-centered computing → Empirical studies in collaborative and social computing; Social networks; Social networking sites; Additional Key Words and Phrases: Post-mortem profile, Facebook, Legacy Contact, digital legacy, impersonal trust, user death, proxy ACM Reference format: Katie Z. Gach and Jed R. Brubaker. 2020. Experiences of Trust in Postmortem Profile Management. ACM Trans. Soc. Comput. 3, 1, Article 2 (February 2020), 26 pages. https://doi.org/10.1145/3365525

1 INTRODUCTION Social computing systems represent and mediate our identities and relationships. If and when these systems misrepresent key elements of these, there are personal and social consequences. Entire identities can be misrepresented or outright denied [20], and accidental disclosures can threaten the very relationships that social platforms are built to facilitate [16]. Designing systems that ap- propriately represent our social lives is complex in the best of circumstances, but the consequences of misrepresentation can be particularly severe in the context of grief. In many cases, the social media content we create while we are alive persists after we have died. While extensive literature has documented the benefits of social media when memorializing the dead [13, 27, 39], postmortem data can present challenges as social media platforms continue to weave this content into people’s daily lives [10]. The bereaved may even encounter photos of their lost loved ones as a result of algorithmically curated content [32]. In a shift from the more

Authors’ addresses: K. Z. Gach, ATLAS Institute, University of Colorado Boulder, Department of Information Science, ENVD 201, 1060 18th St., Boulder, CO, 80309; email: [email protected]; J. R. Brubaker, University of Col- orado Boulder, Department of Information Science, ENVD 201, 1060 18th St., Boulder, CO, 80309; email: jed.brubaker@ colorado.edu. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) mustbe honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. © 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM. 2469-7818/2020/02-ART2 $15.00 https://doi.org/10.1145/3365525

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:2 K. Z. Gach and J. R. Brubaker private grief of the past century [41], families now wrestle with a lack of established etiquette when using social media to notify others of a death [40], let alone how to handle the persistent social media presence that the deceased themselves created [11]. As new systems are developed to enable people to care for postmortem profiles (e.g.,8 [ ]), those who care for these profiles do so in uncharted digital territory and alongside other important postmortem tasks like funeral planning [9]. In this article, we report on the experiences of those “stewarding” postmortem profiles on Face- book. As a framework, stewardship focuses on the relationships and responsibilities that accompany the management of postmortem data and stands in contrast with other approaches that focus on ownership [9]. Stewardship has proven useful for postmortem data management and most notably was the key framework in the design and implementation of Legacy Contact at Facebook [8]. Legacy Contact allows Facebook users to appoint another person to manage certain aspects of their profile upon their death. While Brubaker et al.[9] identified the relationships and responsibilities that were formative to the design of Legacy Contact, their research was based on hypothetical designs. Similarly, the scholarship on Legacy Contact to date has focused on design rationale rather than extensive evaluation [8]. In the absence of a deployed system, this work has been limited by the inability to evaluate these systems with people’s actual lived experiences. We are now addressing this gap. The experiences of active legacy contacts speak to the specific challenges of managing postmortem profiles, while also reflecting known difficulties that people face when handling the digital affairs of their deceased loved ones. We report on an analysis of 28 in-depth interviews with people acting as legacy contacts for the memorialized Facebook profile of a loved one. We describe their experiences, with a focus onthe responsibilities and challenges of managing postmortem profiles. While Facebook’s Legacy Con- tact feature is often helpful to those stewarding profiles, they still experience difficulties. We found that legacy contacts’ priorities—and frustrations—stem from their views of trust, particularly when the responsibilities with which they felt entrusted were limited by the functionality of the system. Building on this finding, we examine trust in two ways: its implementation in existing postmortem data management systems and its role in emerging digital grief practices. We pose questions about how interpersonal trust is operationalized within data systems and about the significant points of tension and breakdown when these systems fail people. We conclude that the current difficulties in postmortem data management are due to a discon- nect between how systems technically implement trust and people’s expectations that are based on an open-ended form of trust within their relationships. In the context of postmortem data and digital memorials, we argue that trust is the assignment of managing ambiguity to an individual who is perceived to be capable of balancing the values of the deceased with the needs of the deceased’s social network. We offer this definition to guide designers of postmortem data management systems in considering the social significance of stewarding a digital identity. Finally, we consider how current affordances of social computing systems may be unsuited for the needs of digital heirs.

2 RELATED WORK Our study builds on previous work that approaches postmortem data management as a form of “stewardship.” As Brubaker et al. describe, “stewardship focuses upon carrying out responsibilities entrusted to the steward” [9, p. 4158] (emphasis added). Brubaker et al. situate trust as essential to stewardship yet do not provide an explicit definition. In our study, we found that both the designs around stewardship and our participants discuss responsibilities in terms of “trust,” but these definitions of trust were almost always implicit. Our current analysis highlights the rolethat trust, in its multiple forms, plays in the work of stewarding a postmortem profile and elaborates on the nature of trust within the context of stewardship.

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:3

Fig. 1. Interpersonal trust involves delegation to Fig. 2. Interpersonal trust can be maintained and reliance on another person. Continuous com- via ICTs when they support vulnerability, open- munication ensures trust by reducing uncertainty endedness, and real-time interaction. about others’ behavior.

Fig. 3. Reputation measurements, identity veri- Fig. 4. Impersonal trust describes relying on a sys- fication, and visual indicators are used to com- tem to act as expected, such as expecting that an municate trust in mediated interactions. email sent arrives to the intended recipient.

To ground our analysis, we first address scholarly definitions of and problems regarding trustin social and computer sciences. We then connect this scholarship to postmortem data management and the design of related systems, as those technologies and techniques are what people must be entrusted with after a death.

2.1 Understanding and Implementing Trust While there is an enormous body of work regarding trust across many disciplines, social computing scholars most often address trust in terms of interpersonal trust and impersonal trust. Interpersonal trust is concerned with delegation to and reliability of another person (e.g., “if I ask something of this person, will they follow through?”), while impersonal trust focuses on the reliability of systems and organizations (e.g., “If I send an email to this person, will they receive it?”). Both types of trust are avenues for managing expectations and reducing complexity in interactions but have key differences in practice. 2.1.1 Interpersonal Trust in Social Computing. HCI and social computing scholarship have attended to interpersonal trust since their beginnings. Previous research generally describes interpersonal trust in line with the definition of Li et al.: “the willingness of accepting vulnerability or risk based on expectations regarding another person’s behavior” [26]. See Figure 1.

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:4 K. Z. Gach and J. R. Brubaker

Interpersonal trust has been of particular interest within the CSCW community. In the context of email, for example, [37] found that people struggled to establish interpersonal trust when tasks were coordinated over email, but that in-person communication could establish and repair interpersonal expectations, thus increasing a sense of trust. See Figure 2. Beyond email, researchers have studied many communication systems to address virtual trust in work environments. For example, Knowles et al. researched “the difficulties of trust surrounding remote work activities” [23, p. 328], addressing the problem of the “unseen person” [19]thatanem- ployer must entrust with tasks across time and distance. Meanwhile, in the context of e-commerce, [18] found that trust is more easily achieved between businesses and their customers when real- time interaction is possible. In each of these studies, it is evident that trust is best established when communicating persons are visible to one another and communication is synchronous. HCI scholarship has also found connections between interpersonal trust and control. In extreme situations like civil unrest, [38] found that trust offers a sense of control, and that technology can facilitate recovery of interpersonal trust among neighbors. However, [5] finds validity in concerns about issues like dishonesty when communicating via technology: people do lie, but in efforts to maintain social cohesion. It is important to know of such nuanced behaviors because the opportunity to lie is part of trust. The necessity of that opportunity makes sense when we understand trust as “a tool for complexity reduction” [3]. 2.1.2 Systems Approaches to Interpersonal Trust. Designers and HCI scholars have made specific efforts to design for trust, but their efforts have varied. Erickson and Kellogg’s seminalpa- per on social translucence argued that designers should “make social information visible” with accountability, visibility, and awareness [14]. Social translucence is present in systems that communicate social cues, enabling clearer context among participants. To this end, researchers have used “trust models” [24], reputation measurements [3], and visual indicators [30] to communicate elements of interpersonal trust in systems. See Figure 2. For example, Marwick and boyd [30]ex- amined verification on Twitter and found that perceptions of authentic intimate disclosure from verified accounts give people a sense of trust in those celebrities. A Twitter verification badgeis a design solution that communicates accountability, and therefore supports user trust in celebrity communications. 2.1.3 Impersonal Trust. In the broader ACM community, a conceptually different set of questions focuses on impersonal trust, or how people trust the technical systems with which they interact. There are two sides to impersonal trust: Does the system behave as expected? And is the system guarded against the interference of malicious actors? Impersonal trust is most notably asso- ciated with trustworthy computing [36] and is a system-centric approach to designing technology that is secure, private, reliable, and responsive. Authentication, encryption, and access control lists are quintessential strategies for impersonal trust. See Figure 4. In the context of social media and system design, impersonal trust is often managed through configurations of account settings and personal data, from login credentials, to privacy settings, to accepted friend requests. The management of impersonal trust on social media finds its foundation in work from computer security that focuses on identity verification, account credentials, and authorizing access to resources [21, 22]. Trust in social media has also been extended to recent issues of news credibility, an area in which indicators of trustworthiness may be able to help readers distinguish between accurate information and misinformation [43]. Just as [23] addresses whether coworkers trust the accuracy of data produced within task tracking systems, impersonal trust extends to social media in users’ trust that the system accurately represents their privacy and relationships. Framing impersonal trust as “technology trust,” [25] finds that Facebook specifically “may demonstrate either interpersonal or technology trust characteristics.”

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:5

The result is that people may trust Facebook as a “quasi-person,” further muddling distinctions between interpersonal and impersonal trust [25]. 2.1.4 Combining Trusts in HCI. Though “interpersonal” and “impersonal” are respectively recognized as social and technical approaches to trust, the systems we build and study in social computing research constantly deal with both approaches in combination. In the context of HCI and social computing, Knowles et al. [24] tell us that a primary indicator of distrust between people is micromanagement. For a system to both work well and communicate trust to a person, it must provide the ability to make choices, mistakes, and corrections: “give them opportunities to fail ... and then make sure they don’t fail” [24, p. 332]. While establishing trust is central to any relationship, trust is further complicated when interpersonal interactions are mediated by technology. As Handy wrote, “E-mail and voice mail have many attractions, but they are not the same as watching the eyes of others” [19]. Pervasive yet undefined references to trust in HCI work speak to the complexity and importance of relationships between people and systems. Throughout the HCI literature, we see that trust is established and maintained through regular interactions in which one party is vulnerable and the other meets their expectations. The key needs of trust interactions—vulnerability, open-endedness, and real-time interaction—are parallel to the principles of social translucence [14]. However, as Ackerman highlights, there is often “a fundamental mismatch between what is required socially and what we can do technically,” what he refers to as the sociotechnical gap [4]. The context of death and postmortem management presents an additional design challenge: how might a computational system support nuanced forms of interpersonal trust when one of the trusting parties is deceased? Supporting these forms of trust is further complicated by the ambiguous and underspecified expectations that constitute this trust. 2.1.5 Trust in Death. Trust is a foundational aspect of familiar offline practices related to death. Final wishes and funerary preferences shared with loves ones are examples of interpersonal trust. Yet preferences can also be formalized through advanced directives, wills, and “Do Not Resuscitate” orders. Formal directives such as these resemble forms of impersonal trust in that they ensure actions are performed according to a person’s wishes. The complexities in how these two types of trust play out are well known among estate planners, who may rely on impersonal mediation clauses or family court proceedings to settle disputes among loved ones [29]. In contrast to its explicit role in formalized end-of-life wishes, trust has been a predominantly implicit aspect of the systems, studies, and design work in postmortem data management [9, 34]. Yet trust has also been an explicit (if unexamined) part of design, as in the prewritten Legacy Contact message we will describe below. There are important parallels between virtual trust and postmortem data management. Just as virtual trust in remote work addresses the “unseen person,” trust in postmortem data management involves a person who is absent: either in death or in their role not existing until the death of the trustor. Postmortem trust is an especially complex problem on Facebook because people are not just inheriting data but using memorialized profiles to maintain bonds with the deceased and thede- ceased’s network [6, 17]. This problem is further complicated for the legacy contact—the executor of this “digital will”—who may not have instructions about how the data should be handled [33]. In the convergence of data and death, we find especially complex issues in how people trust others through technology, and in how they trust in the technology itself.

2.2 Postmortem Management in the Digital Age Social media has changed experiences surrounding death and grief. Brubaker et al. describe the increased number of people who can be affected via Facebook by a single person’s death10 [ ], a

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:6 K. Z. Gach and J. R. Brubaker phenomenon that Walter argues is a return to patterns of community mourning that defined the preindustrial era [41]. “The world comes to feel a bit like a pre-industrial village,” Walter writes, “inwhichmournersarevisibletoall,andtollingbellsheardbyall.[...][T]hewholerangeofboth main and marginal mourners encounter one another through their (online) mourning behaviour.” Along with increasing the community involvement surrounding a person’s death, social media accounts may also affect experiences of grief because they can perpetuate the perceived presence of the account holder [11]. It remains unclear whether surviving loved ones, already tasked with much in the wake of a death, find more comfort or burden in postmortem profiles and online memorial practices. Beyond the most immediate loved ones’ needs in the midst of their grief, there are further issues to consider for system users who are affected by the death. A number of systems and frameworks for postmortem data management have been proposed to address the complex problems for social computing systems when account holders die [2]. Much of the complexity stems from a lack of awareness of death in HCI design [31]. Complexities include issues of privacy and access, such as whether the deceased would have wanted to disclose certain sets of their data, and whether digital artifacts are different from other assets [9]. In earlier work, Locasto et al. discuss postmortem data issues in the context of a “digital identity footprint” to inform design frameworks that enable shut- ting down accounts when a person’s life has ended [28]. In subsequent years, both Facebook and Google have provided ways for surviving people to manage a deceased person’s account and/or data [8, 33]. These measures by Western society’s primary social computing systems are a positive indication that postmortem data management is no longer being ignored. Both Google Inactive Ac- count Manager and Facebook Legacy Contact rely on preplanning and interpersonal relationships, allowing users to select an individual who can have some management capabilities for their account once they pass away. Going forward, it will be important to further these efforts by analyzing their quality and effectiveness and adapting the systems accordingly. This study is such an effort. In addition to handling account holder death, we must consider the people affected by the death. Beyond systems that were designed explicitly with death in mind, other systems such as 1Password or LastPass exist for general account and password management but contain valuable affordances for postmortem data management. These products allow subscribers to collect and store account credentials, notes, and links for their own reference and can be easily bequeathed to another person. However, in cases where the user did not bequeath any access to these systems, no options exist for retrieval of the information that surviving persons may need. Managers of 1Password, for example, attribute the lack of “backdoor” options to the prioritization of active account security [1], as described in [21, 22, 33]. What all of these systems have in common is the need for a repre- sentative to implement the expressed wishes of the deceased. Choosing such a person to manage digital assets is still not commonplace, so solutions remain convoluted. In its novelty, the setup of postmortem data management systems contains highly consequential yet often unspecified expectations for the person charged with that management [33]. Because people use postmortem data to maintain bonds with the deceased [17] and to engage in other known online grief practices [27], the management of Facebook profiles is an extremely sensitive design space. Overall, we see in these studies that designs for memorials or inheritance rely on assumptions about people, their data, and their relationships. This study questions how and whether those assumptions are working.

3 RESEARCH SETTING: LEGACY CONTACT AND POSTMORTEM PROFILES Our study of postmortem data management focuses on Facebook’s Legacy Contact feature. Launched in 2015, Legacy Contact enables a Facebook account holder (hereafter “AH”) to choose a “legacy contact” (hereafter “LC”) from among their Facebook Friends to be the future manager

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:7 of their memorialized profile. While a full description of the system is published elsewhere8 [ ], we describe the salient aspects of the design here. When an AH selects an LC, they have the option to send the following prewritten but customiz- able message: “Hi [name], Facebook now lets people choose a legacy contact to manage their account if something happens to them. [link to Help page] Since you know me well and I trust you, I choose you. Please let me know if you want to talk about this.” At the time of the study, the following instructions appeared above the edit window: “Let [name] know why you chose them. You also might want to talk in person.”1 Management functionality only becomes available to the LC after the account is memorialized. Accounts are memorialized when someone reports the death to Facebook’s Community Opera- tions team, which then checks the profile for indications that the person has, in fact, died. Once an account is memorialized, the word “Remembering” appears above the AH’s name, and a “Manage” button (only visible to the LC) is added to the profile. At the time of this study, the full extent ofLC capabilities included pinning posts to the AH’s timeline, responding to new friend requests, and updating the AH’s profile picture and cover photo. Additionally, the LC could download an archive of the AH’s data if the AH enabled that option during setup. The LC could not post as the AH, see private messages sent via Messenger, alter past posts and photos [15], or delete new content posted by others to the memorial profile. As a guiding consideration,8 [ ] states, “we sought to reduce automation where possible and encourage interpersonal communication rather than rely on Facebook notifications and configuration”8 [ , p. 3], citing research in which participants described disturbing automated interactions with profiles of deceased persons10 [ ]. By prioritizing interpersonal communication, Legacy Contact seeks to preserve the AH’s agency in his or her settings and preferences [35], while offering the LC necessary management capabilities. The findings below demonstrate that there is one core deciding factor in who should have these capabilities: trust.

4 METHODS AND ANALYSIS To understand the experience of managing a loved one’s postmortem profile, we conducted a qualitative study of 28 semistructured interviews with adult Facebook account holders (10 men, 18 women, aged 20 to 65) in the United States who were acting as LCs for a memorialized profile (see Table 1 for participant demographics). Participants were recruited through a screener survey administered on Facebook to current legacy contacts. One advantage of a screener survey is that it allows people to opt in to the research if they feel willing, able, and interested. However, we acknowledge that selection bias is a limitation in this study. With guidance from our ethics board, we contacted participants who expressed interest in participating in our study and reconsented them prior to their participation in their interview. Interviews ranged in length from 45 to 90 minutes and were conducted over video communication services such as Skype or Google Hangouts (N = 15), or over the phone (N = 13). We began each interview by inviting the participants to tell us about the person whose profile they were managing, and how recently that person had passed away. Participants had been active

1The current message states, “You can use this message to let [name] know why you chose them, or edit it if you’d like. You also might want to talk in person” (emphasis added). An early finding in this study was that many LCs did not knowthe message could be edited. As a result of the authors’ collaboration with Facebook’s Memorialization team, the instructions were changed to clarify that the message can be edited.

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:8 K. Z. Gach and J. R. Brubaker

Table 1. Demographic Information for All Interview Participants NUMBER RELATION TO AH SELF-SELECTED AGE RELIGIOUS AFFILIATION P1 Son Yes 35 None P2 Grandson Yes 40 Catholic P3 Daughter Yes 20 Christian P4 Friend Yes 30 None P5 Spouse No 49 Jewish P6 Spouse Yes 41 Christian P7 Spouse Yes 41 Christian P8 Friend No 62 Protestant P9 Daughter Yes 28 Christian P10 Spouse Yes 65 Unknown P11 Son No 18 Baptist P12 Daughter Yes 41 Atheist (Jewish Background) P13 Daughter Yes 32 Christian P14 Spouse Yes 35 None P15 Daughter Yes 35 None P16 Son Yes 36 Christian P17 Daughter Yes 34 None P18 Spouse Yes 27 None P19 Son Yes 60 Christian P20 Daughter Yes 44 None P21 Son Yes 30 Christian P22 Daughter No 40 Baptist P23 Daughter Yes 55 Christian P24 Sibling No 38 Catholic P25 Friend No 63 Christian P26 Friend No 42 None (Jewish Background) P27 Spouse No 55 None P28 Sibling Yes 34 Christian “Self-Selected” refers to the participant becoming a legacy contact by their own efforts after the account holder had passed away. legacy contacts for anywhere from 4 weeks to 18 months at the time of the interview. They also represented a range of relationships to the deceased account holders, including adult children managing the profile of a parent (N = 16), widows/widowers (N = 6), friends (N = 3), siblings or cousins (N = 2), and one adult grandchild managing the profile of a grandparent. Religious affiliations did not turn out to account for significant differences in Facebook use after adeath.Yet that information did provide context for the authors to be aware of the participants’ worldviews and ask appropriate questions. Even so, we note that our study was limited to Facebook account holders in the United States, and thus the American forms of their various religious traditions. Once we had discussed how the profile was memorialized, we asked the participants questions about their use of each specific management capability (listed above), including practical aspects of its functionality, their motivation and reasoning behind using (or not using) the feature, and others’ responses to their actions. Sometimes, participants were unaware of certain features. In those cases, we described the feature and asked them to explain when they would or would not make use of it. In order to capture the breadth of possible needs, we also asked participants for suggestions about how each feature could be improved to meet their specific needs.

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:9

Both authors engaged in preliminary analyses of each interview as they were conducted, following the coding practices described by Charmaz [12, p.113], and continued interviews until they agreed saturation had been reached. Upon completion of all interviews, we performed a thematic analysis of our interviews and accompanying interviewer notes [7]. Our analysis included details of conversations not communicable in transcripts, such as tone of voice or emotional expressions. Following the development of preliminary themes, the first author reread and recoded each tran- script, writing detailed memos describing the major themes in the experiences and thoughts described by the participants. Both authors reviewed the codes, themes, and memos over three rounds of analysis, combining similar codes and identifying the concepts presented below. To maintain the privacy of our participants, all names and personal details in the quotes below have been changed, obscured, and edited for clarity.

5 FINDINGS We start by describing who LCs are, why they believe they were chosen, and how their relationships with AHs shape their views. We then describe LC practices, focusing on how they perform the responsibilities entrusted to them through the available functionality. We conclude by shar- ing three scenarios in which LCs were unable to perform their perceived responsibilities and thus experienced frustration, hurt, and distress. These difficult scenarios demonstrate what we charac- terize as mistranslated trust, in which LCs perceive a fundamental misalignment of the system’s capabilities related to their identities and practices.

5.1 Who Is a Legacy Contact? We found our participants shared six attributes. LCs were most often self-appointed postmortem by configuring the deceased’s account settings, rather than being selected by the account holder premortem as the system was designed. Whether self-selected or selected by the AH, all the LCs we interviewed were close with the AH, were Facebook users adequately familiar with the platform, were willing to serve, and had an existing role managing the AH’s affairs. Additionally, even though only one person can be designated as the legacy contact on the platform, management often involved multiple people coordinating and supporting each other even as the appointed person executed their collective decisions. We describe each of these attributes in more detail below.

5.1.1 Self-Selected. Legacy Contact was designed to give AHs the ability to make choices prior to their death about how they will be remembered on Facebook. Accordingly, our initial interview protocol included questions about discussions our participants had with AHs. However, our first participant explained that no such discussions ever occurred—P1 had used his father’s account to set himself as the LC after his father’s death. This practice turned out to be common. In fact, even though self-selection was not part of the design, this workaround was the most common way that our participant became LCs (N = 20). In all of these cases, participants obtained access to the deceased’s account (either by having the password, resetting the password, or a device remaining signed in) and used this access to select themselves as a legacy contact. They then signed out and requested the memorialization of the deceased’s account: “I figured out his email password, so I was able to reset my dad’s [Facebook] password, and that’s how I got into his account. Then, from there, I was able to name myself a legacy contact.” (P20, son) While these legacy contacts selected themselves, the selection process they described was often done with input or approval from other loved ones of the account holder:

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:10 K. Z. Gach and J. R. Brubaker

“My brother pretty much just said I was [managing our dad’s profile]. So I think everybody pretty much just trusts that I would make at least decent decisions about how to approach things on his Facebook page.” (P1, son)

Self-selection presents some risks from an account security and policy standpoint and presents challenges for user experience. For example, prior research has discussed the unease people feel when a loved one uses the deceased’s account, sometimes inadvertently posted as the deceased [10]. Our participants indicated that self-selection (as opposed to the intended selection process) was typically the result of the AH being unaware of the feature and not having selected a legacy contact prior to their death. Likewise, many of our participants reported learning about the feature when searching for information about what to do with loved ones’ Facebook account following their death. In P1’s description, we see how he justified self-selection by referring to the trust of the AH’s other loved ones. Below we discuss the attributes of LCs that resulted in them choosing (or in some cases, being asked by family) to serve as the legacy contact.

5.1.2 Close to Account Holder. All LCs identified themselves as close to the account holder. LCs demonstrated closeness through either legal, biological, or otherwise official relationships and always expressed emotional closeness. In cases where multiple people were equally close (as with multiple siblings or children of the deceased), participants explained that, like P3, who described her late mother as her “best friend,” they were seen as being most similar to or having the closest relationship with the deceased:

“We’re a close family and I think that’s the thing. So like with [him], the only reason I thought [the legacy contact] should be me was because I’m the closest to him and I’m into Facebook.” (P7, widow)

LCs also expressed their views of close relationships in describing who they had selected to manage their own account. P1 described choosing his brother because they “share views on pretty much everything.” Being close to the AH indicated that the LC would be aware of the AH’s larger network of loved ones. In the absence of the AH, LCs reported wanting to care for others in the network:

“I feel that in some ways—because she had asked me, and because people had sort of looked to me with the memorial and everything—that I have kind of a responsibility, or even a wish to keep people connected.” (P25, friend)

Keeping people connected was a common priority held by all participants. Many LCs reported relying on Facebook as their only possible method for connecting with friends of the AH they may not have known in their offline lives.

5.1.3 Knowledgeable Facebook User. Every legacy contact we spoke with had a Facebook account. This is practical, as the Legacy Contact feature allows only Facebook friends of the account holder to be selected. Facebook usership was consequential in cases where there may have been a “more appropriate” person to be the LC but that person lacked an account. Additionally, most legacy contacts reported being knowledgeable (or considered knowledgeable) about Facebook:

“You know, my other sisters wouldn’t know what to do. They’re not very tech- savvy.” (P23, daughter)

“[My dad] is not on Facebook. I think he takes pride in that.” (P12, daughter)

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:11

Beyond using Facebook, LCs were selected based on their generally perceived skill with technology. Being considered knowledgeable about technology indicates expectations from the AH’s loved ones that the LC would know how to navigate the platform when needs arise. 5.1.4 Willing to Act. LCs reported that their selection involved being emotionally prepared and willing to perform the expected duties. If the “most appropriate” person for the role of LC did not want to perform the duties, the “next best” person was chosen. P3, when considering her own wishes, highlighted how “willingness” was important: “First off, I’d want to know if they’d be willing to [manage the profile], ’causeif they’re not willing to do it I don’t want to force it on them.” (P3, daughter) As the experience of grief varies greatly between people, whether one would feel “forced” to manage a memorial profile may not be knowable until after the AH has passed away. Even when there had been an opportunity to explicitly discuss selection and willingness with the AH, every LC in these cases reported brief conversations in which they did not discuss specific responsibilities: “We just said that we were each other’s legacy contact ... and that’s about it.” (P5, widow) The lack of a detailed discussion about how to handle one’s Facebook profile postmortem reflects additional realities we learned from our participants. Namely, they were not aware of the actual functionality they would be handed upon memorialization of the AH’s profile. As the AH cannot know what others will need upon their death, they seem to have chosen the LC as someone to whom they could entrust unknowable things. The open-endedness of this kind of trust was evident throughout the LCs’ descriptions of their relationships. 5.1.5 Existing Role in Account Holder’s Life. In all instances, LCs were people who had a default role in the AH’s life, meaning they described themselves as the first person the AH had turned to for significant needs. Having built a foundation of trust throughout the relationship, LCsheld confidence that AHs would trust them to manage their Facebook profile. “She’s the person I run to. She’s my person.” (P3, daughter) “My mom has always trusted my judgment. She could have picked my dad but she wouldn’t have. My dad is actually a very active Facebook user, but ... I don’t know, the relationship was just different.” (P13, daughter) LCs viewed their role in the broader context of their relationship with the AH, rather than in terms of specific tasks. In at least nine cases, the self-selected legacy contact was also managing the will, estate, or other end-of-life affairs of the deceased and saw taking on the role of legacy contact as an extension of these responsibilities. Having such a role justified the LC’s self-selection in the absence of the AH’s choice. Participants’ default role in the AH’s life (whatever the nature of that role) resulted in their selection as LC to feel natural, as it was an extension of their role in the offline logistics that surrounded the person’s death: “I just was in there [on Facebook] managing all of this at the time, so I just put myself as the contact. And I felt like that was fine, ’cause she had expressed tous that she ... you know, that this is what she wanted. And she had given us sort of a whole list of things, both online and off, all of her life-ending wishes.” (P4, friend) “Even though we both knew she was terminal, [the Legacy Contact feature] is not something we talked about at all. Just, in very general terms, that I would take care

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:12 K. Z. Gach and J. R. Brubaker

of everything. And I had all her passwords, her will, all that kind of stuff, all her tasks and everything.” (P13, daughter) When AHs did have the foresight to select their own LC, other responsibilities were also discussed in comparison: “His brother was his Power of Attorney, but he trusted me to pay bills and stuff while he was ill.” (P8, friend) LCs in these examples use the unspoken trust embodied in related responsibilities to justify what they should be able to do. Matters of Facebook being discussed in “very general terms” indicates two things: first, that people are not necessarily aware of any specific terms of managing memorialized profiles, and second, that trust in these relationships exists even without full knowledge of what is being entrusted. In the absence of specific instructions, LCs either did not actor turned to other people for guidance. 5.1.6 Involves Decisions of Multiple People. Sometimes a Legacy Contact is not one person, but a delegation of collective action within an intimate group. In the case of P4, while she was designated as the official LC in the system, decisions about the management of the AH’s profile were made among a group of the AH’s close friends: “We called each other ‘cousins,’ but I would describe our relationship more as sisters. ... So since she had said she wanted me to write [her last blog post], and we all kind of felt like there needed to be some kind of closure to the blog, [the] group of us that all grew up together, we co-authored it. ... And I think her husband trusts us to deal with [the Facebook profile and blog]. It’s definitely not something he wants to do, so he’s happy to have us do it.” (P4, friend) P4 expressed the importance of each woman feeling included and heard as they remembered their friend. Participants regularly reported the need to consult others about the management of the memorialized profile. The specific reasons varied, but all illustrated the limitations ofLC responsibilities sitting with one person alone. P3, for example, discussed how each person she was working with knew different people from the deceased’s large network, while P16 regularly consulted others when making decisions as LC to ensure that various people, grieving differently, would not be negatively impacted. Finally, one refrain was shared by many participants: being the LC is a lot of work. Group consultations about memorial profile activities were one way that LCs addressed the unspoken expectations in being entrusted with the AH’s memory. That trust is defined not by specific requests or instructions, but by an open-ended sense of confidence thatthe AH would approve of what the LC decides to do. Without specific instructions, LCs felt that they should be able to do “whatever.” The lack of specifics in what LCs feel entrusted to do indicates that trust, in these relationships, has few limits. Since trust is broad, the LCs’ views of their role are broad. These six attributes describe who LCs are. Though Legacy Contact was designed to be part of planning for one’s own death, we found that it is more commonly set up postmortem in a process of family consensus. Though our interview participants have one or all of these attributes in common, they enact their responsibilities quite differently. We now discuss the specific actions available to LCs within the system.

5.2 Enacting Trust on a Memorial Profile Legacy contacts enacted their responsibilities within the context of the interpersonal trust of the account holder. Given the lack of specifics in people’s answers in the previous section, we turned to

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:13 practices to identify how interpersonal trust was articulated and practiced. In our interviews, participants described which features of Legacy Contact they used or avoided using. In our analysis, we found it most helpful to consider these decisions in terms of how LCs evaluate the appropri- ateness of various solutions. Specifically, LCs thought back to what the AH valued, forward to how the AH’s network might be affected by their actions, and inward to what they would want for their own memorial. We found that LCs exhibited multidirectional thinking to consider the possible results of their management actions, and that their skill in such thinking demonstrated their fitness in the role with which they felt entrusted. 5.2.1 Thinking Back. We found that LCs thought back when they considered what the AHs valued during their lives and what choices they had made on Facebook that expressed those values. Thinking back happened with specific items on the profile that expressed these aspects of whothe AH was, including photos, shared posts, and memories encountered through “On This Day.” LCs thought back to the AH’s life when they considered how to keep the memorial true to the AH’s identity, including the AH’s interests, voice, appearance, and various relationships. The resulting decisions, however, could differ. “If she had wanted a [cover] photo, she would have put one up there.” (P12, daughter) “He loved bald eagles, so I made a bald eagle the cover photo.” (P1, son) In thinking back, P1 used his knowledge of his father’s preferences to make a change to the profile. In contrast, P12 avoided acting with her management capabilities to preserve her mother’s choice. With similar priorities, these LCs made different decisions. Discrepancies among LC decisions represent the importance of the LC’s ability to customize the memorial according the community’s evolving needs rather than the account holder’s fixed preferences. 5.2.2 Thinking Forward. We found that LCs thought forward when they considered the variety of needs of others who were invested in the memory of the AH. Thinking forward occurred when LCs encountered new content that appeared on the memorial profile or in relation to the AH: pinned posts, messages to the AH, or fielding of new friend requests. When LCs described thinking forward, they focused on caring for everyone connected to the AH, avoiding confusion, and preventing additional distress related to their grieving processes. “I also feel that [posting on the profile] intrudes a little bit on people’s lives, ’cause there are still some people that are still very torn up about it, and I don’t want that to be thrust upon them in the middle of the day. You know, they just check Facebook on break at work, and all of a sudden, they’ve got some posting about an anniversary or whatever. And that sentiment will spiral.” (P14, widower) “I didn’t go in and accept anything because I was all, ‘how will they feel having a friend request accepted from someone they know is gone?’ So I’m just leaving them alone for now.” (P9, daughter) In these examples of thinking forward, the data again demonstrates that LCs often concluded that inaction was their best choice for reasons that reflect care for the LC’s larger network of loved ones, including “how will they feel” and who was “very torn up about it.” Thinking forward also affected discussions of who the LC should be in the first place: “I think she would have chosen me ... because you want to pick someone who’s going to be around for sure after you are, so more likely you would pick someone younger. So I probably would have been her choice.” (P16, daughter)

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:14 K. Z. Gach and J. R. Brubaker

Considerations of the age of an LC also appear in this theme, suggesting that longevity of the memorial matters. As most of the participants were managing the account of a parent, they alluded to a timeline of several years in which the memorial profile would be used, needed, nice to have, or fulfilling its purpose for others who loved the AH. 5.2.3 Thinking Inward. We found that LCs thought inward when they relied on their own judgment to make choices in the AH’s place. Inward thinking involved considering their own preferences, especially when the AH’s values were difficult to identify, such as the choice to delete the profile or add people who were not previously connected to the AH on Facebook. “I feel like it’s not so much what I wouldn’t want to be able to do as a legacy contact, but I’m thinking more of my own account and the point where I pass away. ... I don’t want somebody going in and deleting it.” (P2, grandson) Thinking inward about what LCs would want for themselves was about enacting trust amid uncertainty. Inward-thinking choices were strong indicators of the interpersonal trust in the AH- LC relationship because those choices involved the LC feeling justified in applying their own core values to circumstances they could not discuss with the AH. Again, inaction was common. When our participants considered their own preferences as a guide for what actions to take as an LC, participants predominantly spoke in terms of what should not be done. A paradox emerged in participants’ discussions of their choices not to act: though LCs do not wish to perform certain actions, they want the ability to do so: “I kind of like leaving it as it is. But it’s also nice knowing I do have that ability [to make changes], if need be.” (P2, grandson) Here, P2 finds comfort in his ability to choose inaction and to respond to any unknown future needs. “[Memorializing, then doing nothing] has been perfect for me. It really has. It ac- knowledges that she’s no longer here, but doesn’t put me in a place where I have to make her vanish. I don’t know if I was trying to hang on to whatever was there. ... I didn’t want it to be like she didn’t exist.” (P12, daughter) For P12, we see that her link to her mother’s account as the LC makes the difference between her intentional preservation of the profile and feeling that her mother has been forgotten. “I mostly just want it to be there for people to look at, because Facebook has played such a big role in our lives over these past few years. There’s so much on here, pictures tagged of her, pictures she’s posted, and I want to keep it there. The thought of being able to delete it and have it gone in a few clicks really hurts.” (P3, daughter) These three examples indicate that memorialized profiles become meaningful to the AH’s loved ones and that maintenance of that meaningful space, even by inaction, matters to them. Through LCs’ descriptions of how they maintained profiles through inaction, we came to understand that access to controls—simply having the option to act—represented the impersonal system’s trust in the LC. When LCs did use their management capabilities, it was with great care and consideration: “I did add my parents [to my sibling’s profile] eventually. But that was a really hard decision for me because I knew he hadn’t added them before. But I talked about it with my husband a lot, and he said, ‘Hank put you in charge and he figured you were going to make the right decisions, so whatever decision you make is right.”’ (P24, sibling)

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:15

Notice how P24 relied on the ambiguity of her sibling’s interpersonal trust to find a foothold in acting differently than he did. She described her responsibility with a vague “whatever decision,” which appeared in other participant descriptions: “whatever comes up” or “whatever is necessary.” So, for LCs, acting in the stead of the AHs did not necessitate doing exactly what they did. It did, however, necessitate an understanding of the AH’s core values and making judgments accordingly.

5.2.4 Multidirectional Thinking. In many cases, making good judgments as LC required more complex multidirectional thinking. In these cases, LCs weighed and reconciled competing needs: “I know, for me, it’s hard to go on [the profile], but I do. ... Her friends would go on her page and say, ’Oh, we missed you at the party.’ Because it kind of—she was a very—she loved life, and I like to see other people interacting within her Facebook. That’s joyful.” (P23, daughter) Here, P23 thought inward to what she personally felt, that looking at her mother’s profile was difficult. However, she also exhibits forward thinking in her awareness of other people’s needsto connect with the profile. Across our interviews, participants mentioned photos as an especially complex consideration for LCs, both as a representation of the deceased and as part of how people interact with the memorialized profile: “I changed the profile picture within a day or two of her passing because shehad a photo of her bald head as her profile picture. And I figured if we’re gonna doa memorial page, it might as well be how she was, not how she wound up.” (P14) Profile photos are the most ubiquitous representation of the AH’s identity, and thus a sensitive thing to change. At its core, P14’s decision thinks back to photos the AH had chosen for herself before her illness, but also implies more inward thinking about P14’s personal preferences. Main- taining the AH’s choices was the most commonly expressed factor in how LCs made their choices, but as demonstrated by P14’s choice, it is not universally the best when considering the AH’s whole identity. LCs must decide what aspects of the deceased to highlight. The patterns of how LCs think represent the ways LCs care for an AH’s loved ones, especially if those people are unknown to the LC. Backward, forward, and inward considerations are the practical ways LCs address the ambiguity of the AH’s interpersonal trust in them. LCs act as a proxy for the deceased while still being importantly distinct from the deceased. Our participants recognized their power to affect how AHs will be remembered by others. How they use that power, or how they think they should be able to use it, is at the core of the concept of interpersonal trust. When our participants found that the limited functionality constrained their ability to manage an AH’s profile, they felt the AH’s trust in them had likewise been minimized. In the next section, we examine three instances of LCs experiencing such breakdowns between the responsibilities entrusted to them and the functionality provided.

5.3 Trust-Related Stress Cases We have shown that participants felt entrusted with a significant and open-ended role among the loved ones of the account holder. Their understanding of their role, in turn, resulted in an open- ended view of their responsibilities as an LC. With a broad set of expectations and perceptions about what they can do within the feature, our participants felt that they entered into a system with narrow management capabilities. Throughout our interviews, LCs indicated that they expected the ability to fix any problems that might arise with the memorialized profile. In practice, they found that such broad controls were not available to LCs. While a straightforward approach may have been to enumerate the specific

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:16 K. Z. Gach and J. R. Brubaker functionalities they found absent, our analysis suggests that the root of their issues stems from the failure of the feature to meet their expectations. As such, in this section, we share three scenarios that demonstrate the challenges LCs face when they attempt to fit their broad expectations into Facebook’s specific memorial management functions. In three particular stress cases, we saw that attempts to exercise interpersonal trust in a system that primarily understands impersonal trust results in LCs feeling that both forms of trust have broken down. In most instances, these stress cases are related to intentional design decisions the team at Facebook made based on the research that existed at the time. These stress cases are instructive to designers of postmortem systems as they weigh the tradeoffs in their own design processes.

5.3.1 Stress Case 1: Notifications. As noted in the previous section, LCs described their role as doing “whatever is necessary” in an unknown situation, demonstrating that trust is characterized by ambiguity. When “whatever is necessary” turns out to be impossible within the LC management system, impersonal trust between the LC and the system is broken—and this break is painful. Consider the case of P5: her prior experiences with Facebook led her to believe that she would receive notifications about things that were important to her. However, the design of Legacy Contact involved a conscious decision based on prior research to “reduce automation where possible and encourage interpersonal communication rather than rely on Facebook notifications and configuration” [8]. P5 described a deep sense of responsibility to her late husband’s profile as a space where many people were remembering him. However, P5 explained that she was surprised to not receive any notifications about the activity on his memorialized profile. P5’s expectations were important because notifications were what enabled her to maintain communication with her late husband’s friends. Without checking his profile every day, which she reported could be difficult depending on her emotional state, she was still attempting to maintain the responsibility of responding to activity on the memorialized profile. However, many posts had appeared on the profile unnoticed. She became aware of this discrepancy during the course of her interview: “I wish I would have seen [these posts] sooner. And of course it’s very sad. I mean ... I would have been able to Like them earlier. It’s almost as if it appears that I didn’t care about other people who cared about him and that’s not even true. So it would have been nice if I was able to actually see these from the beginning. I don’t understand how I didn’t even see these before because they were so far down I guess because they compressed them. You know how Facebook compresses a lot of things? And that can make it difficult to see because, again, I didn’t see them and I’ve been on this page.” (P5) In some cases, Facebook combines similar, frequent posts into a single carousel frame that the user must click through to read. This had apparently occurred due to the high volume of posts on the profile—posts of which P5 had not been notified. Without notifications, P5 felt thatshehad failed in her social role of acknowledging and connecting with her late husband’s online friends: Researcher: “Wow. Ok. So because people had posted things to the memorial page and you’re the legacy contact, you feel like you had a responsibility to reply to those people?” P5: “Yes ... Yes. At least if I would just acknowledge them. Now I mean it’s six months later. I mean yes, there’s a whole bunch on here actually that I didn’t see. That is very concerning ... ’cause I’ve liked some of the comments but going back to—god, it’s hard to look at pictures of him. It was I guess his little sister tagged

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:17

him and me in this one. So I did see it before but scrolling down the wall—yeah, this actually is, the way they have it set up I wish I would have been notified with everything that was on here or that I would be in the future notified. ... I mean there should be a notification if somebody does anything, that will have their post show up on his page so that I can make sure that it’s not spam, that it’s not inappropriate.” In P5’s circumstance, the connection between her and her husband was only reflected in her access to a few management features. In describing this experience, P5 used a helpful analogy: “It’s like you’re going on vacation and you need your friend to come in and take the mail and everything like that. You give them them the keys because ... it’s the mutual understanding that they can trust you with their keys to do whatever they need to do in your house. You can’t do that with a legacy account. The person gives you a key, but ... it’s like it opens up a certain room instead of the entire house.” (P5) Nothing within the system could reflect the intricacies of what P5 felt her husband had trusted her to do in communicating with his multitude of online-only friends. Technically speaking, Legacy Contact had implemented the fact of their relationship, but not the open-endedness of their trust. As an exceptionally knowledgeable Facebook user, P5 had no reason to expect that memorializing her husband’s profile would change her reception of notifications. In fact, notifications are not mentioned anywhere in Facebook’s Help Center pages about Legacy Contact or Memorializa- tion options [15]. The Help Center does explicitly describe the interactions in which memorialized profiles do not appear (i.e., event invitations), but legacy contacts do not have choices about these interactions.

5.3.2 Stress Case 2: Curation. In the previous stress case, P5 referred to a related concern of “making sure things are not spam.” Her concern is shared by others, like P13 and P14. “[My mom’s profile is] really cluttered. When, you know, someone dies and you’re going to their page I imagine you just want to remember the things she talked about. You’re not interested in who she beat in Candy Crush or Pet Rescue. ... I want to keep anything that she wrote or anything she shared—I want to keep all of that stuff, who she was.” (P13) Participants may wish to “declutter” the profile so that it can function as a memorial, rather than the hub of interaction that it was during the AH’s life—particularly when Timeline content is not seen as important. When repurposed as a memorial, P13 felt the profile’s interactive game posts had become “spam” and were not desirable for the memorial experience her community needed. Similarly, P14 expressed a need to manage new contributions to the memorial by deleting or hiding new posts: “[I need] you know, comment moderation or post moderation—if not outright deleting it, at least restricting its use so that no one can see it. Because I do also understand that people cope in different ways, and they have radically different ideas about what’s appropriate and what isn’t. So, rather than just say, ‘No, you can’t go to this page anymore’ just hide the post and have it be automatically hid- den so that no one can see it. That way, they get their outlet and people who are bystanders don’t have to deal with it.” (P14)

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:18 K. Z. Gach and J. R. Brubaker

Here, P14 held the expectation that he would be able to keep his wife’s memorial profile “appropriate” to a variety of people. In practice, that emerged as a need to hide what certain people were posting. In his situation, people were posting things that were seen as harmful, painful, or destructive, which he said increased the difficulty of maintaining his wife’s memory in an honor- able way. P14 was unable to hide those harmful things and thereby feel that he was protecting the AH’s memorial. The creators of Legacy Contact described its limited functionalities as an attempt to “reduce the workload on legacy contacts, who are grieving themselves,” as well as “to keep the profile intact, while still facilitating the community practices happening on the profile8 Wall”[ ]. Yet in these stress cases, the lack of ability to curate, clean, or otherwise maintain a respectful memorial profile violated the LCs’ expectations and affected their feeling of capability toenact their person’s trust.

5.3.3 Stress Case 3: Functionality Not Working as Expected. Technical solutions are not always easy or even possible. In the case of P21, his late mother’s settings were implemented exactly as P14 wanted in the previous example: no one could see new posts on the memorial profile. “I started trying to get information out to people about my mother’s memorial service. ‘My mother’s memorial service will be here at this place.’ And I pinned it. I’m supposed to be able to pin a post so everybody can see it. Unfortunately, I put the post up there, and I pinned it [to her profile], but then we found out that nobody could see it.” (P21) What P21 felt would have fixed this problem was full control over the AH’s settings, to disable the preference that required the AH to approve posts. P21 described a situation in which the needs of the AH’s community were not being met and, according to all available information about the Legacy Contact feature, should have been met. The result was him feeling powerless. In both cases of P14 and P21, our participants were trying to protect and care for the community and were unable to do so. For P14, he was unable to protect the memorial from inappropriate posts. For P21, privacy settings of the deceased prevented the LC from connecting with the AH’s network. These situations both represent ways the system violated the expectations of these LCs. When we recall that [26] relates trust to meeting expectations and distrust to violating expectations, P21’s feelings of broken trust make sense: “I was making medical decisions for her for the past few years. I was making fi- nancial decisions for her. And then Facebook says they can’t trust me to manage her Facebook account? So it’s like well, I can do all these other things, but I can’t do this? I can understand—I understand the reasoning. But if somebody is a legacy contact, then you have to assume that that person is trusted enough to administer the account fully.” (P21) In these negative feelings, we found that P21 had expected Facebook to fully enable the open- ended trust the AH had in him as exemplified in the gravity of his related responsibilities. Essen- tially, P21 expected not just a few capabilities, but the full confidence of the AH-LC relationship to be enacted within the system. The negative experiences LCs described to us were all moments of encountering their limits within Facebook’s functionality. LCs do not always discover their limitations because, as we see above, inaction is largely considered a good choice. When LCs do encounter limits, it is during moments of need that could not be anticipated. Because the LCs we interviewed were mostly self-selected, they did not have clear instructions from the AH regarding the management of the memorialized profile. LCs had an open-ended role within the AH’s life and community, sothey

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:19 experienced distrust from Facebook when that open-endedness was not reflected in the system. As explained in the section on Related Works, two kinds of trust are apparent in this system: interpersonal trust and impersonal trust. Both forms of trust are visible here. LCs have impersonal trust in the system to enable them to do whatever is necessary for the bereaved community, or to do whatever they feel the AH would have asked in the context of their interpersonal relationship. How LCs perceive what is expected of them stems from the open-endedness of trust that the AH held in the LC throughout their relationship. In describing the varying expectations among LCs, we find that their expectation to do “whatever is necessary,” while typically opting not toact, means that the system’s trust in the LC is a symbolic need rooted in the LC’s desire for agency.

6 DISCUSSION During times of death, surviving loved ones are entrusted with tasks that require working with impersonal systems to care for the bereaved community and resolve the affairs of the deceased. It is not yet common for legal documents that specify or formalize these tasks to include social media accounts or online memorials, and so postmortem data management remains challenging. More- over, our data suggests that even if more robust formalizations existed, participants would continue to find them problematically restrictive. In many ways, Legacy Contact adequately meets people’s needs in communicating that the AH has died, protecting the account, and maintaining a space for the bereaved to maintain bonds with the AH and the AH’s network. Yet, Legacy Contact could be considered a work of experimental design on Facebook’s part: there were many unknowns in its implementation because no large-scale management system for social media memorials had ever existed before. Therefore, the findings we share here provide valuable insight for any social media platform in which loved ones of deceased account holders may find enduring value in the content one leaves behind. Such platforms must construct appropriate options to maintain that content securely, while providing loved ones with adequate access to and control over their loved one’s persistent presence. What follows are two major concepts based on our findings that could guide any social media platform’s implementation of any system in which interpersonal relationships with deceased persons must be represented and enacted. We conclude with guiding questions for the future of postmortem data management systems.

6.1 Mistranslated Trust Throughout our findings, we saw how the design of Legacy Contact relied on both impersonal and interpersonal forms of trust. While the interaction design of Legacy Contact focused on interpersonal forms of trust, impersonal trust plays a role in how permissions and delegation are operationalized in the system’s functionality. In the context of postmortem data management, identifying the role of both forms of trust highlights how the challenges of supporting stewardship practices are less about specific features and more about how people feel the features align with the roles and responsibilities with which they have been entrusted. See Figure 5. Just as [38] found that trust provides a “sense of control,” trust for LCs is related to expecting controls—functionality— that the system does not allow. In the three stress cases, participants reported that a lack of control feels like a lack of trust. Ultimately, the negativity of the experiences described in our stress cases is the result of two fundamentally different trusts being conflated. Just as some languages donot have adequate words for certain concepts from other languages, computational systems do not have a way to understand or communicate trust in its vulnerable, interpersonal form. The ramifications of mistranslated trust are complex. When LCs’ expectations of thesystem were unmet in ways that prevented them from performing their responsibilities, LCs did not feel untrusted by the AH or their network; LCs felt untrusted by Facebook. When we review the depth of consideration that LCs described for each possible decision (see Section 5.2), the insult

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:20 K. Z. Gach and J. R. Brubaker of distrust is especially sharp. Feeling distrusted, best demonstrated through P21’s stress case, recalls the argument in [25] that Facebook may be seen as a “quasi-person.” In this regard, LCs describe expectations of Facebook being able to reciprocate the trust of a social relationship. LCs’ expectations of Facebook align with interpersonal rather than impersonal forms of trust. See Figure 6. They expect Facebook to trust them the way AHs did: generally, open-endedly, and adaptively. Because interpersonal trust is general, open-ended, and adaptive, participants described anything they could not do as a betrayal of the trust placed in them as the LC. In the three stress cases we described, participants had no way of knowing that their limited access was a conscious design decision and considered to be compassionate for grieving people in other circumstances. For example, the lack of notifications about memorialized profiles is a direct result of the design choice to prioritize the AH’s agency over system automation [8]. Here we see an alternative experience to those described in prior research, which indicated user discomfort with automation related to profiles of the deceased. Participants’ desire for automation suggests a new need that may be specific to the context of Legacy Contact. Likewise, participants looking to curate content on the AH’s profile were subject to design decisions that were intended to be compassionate. The inability to curate posts was one of many functionalities that Facebook designers intentionally excluded: “a limited set of valuable functionality was preferable to large set of configurations, features, and responsibilities”8 [ ,p.5]. In the bequeathing of valuable functionality to LCs, we argue that interpersonal trust is being translated into a system that primarily understands impersonal trust. The disparities between the interpersonal form of trust described by our participants and how this was operationalized into the impersonal forms of trust in the system resulted in misaligned expectations for LCs, exemplified in our stress cases. Though work in HCI blurs the distinction between impersonal and interpersonal forms of trust, the case of postmortem profile management makes clear how the expectations that accompany interpersonal trust are translated into systems that may be unable to adequately support those expectations. While secure systems rely on impersonal trust, a focus on LC experiences highlights how such systems also rely on interpersonal trust among co-users of a system—trust that is only possible through adaptation and workarounds that become impossible after one person in the trusting relationship has died. The challenges experienced by our participants highlight how even technology designs like Legacy Contact that seek to support interpersonal trust are constrained by an infrastructure that privileges impersonal approaches to trust. We argue that postmortem management should honor the needs of surviving loved ones through design centered on interpersonal forms of trust, rather than simply operationalizing trust into a set of permissions. For example, allowing co-configuration of postmortem data settings between account holders and person(s) of their choice would facilitate the specificity required by the system within the context of the trusting relationship. Once a profile is memorialized and the LC’s management is activated, accommodating trust becomes complex: the profile contains digital assets to be handed down but is also a memorial space for people to maintain bonds with the deceased and connect with others who are bereaved by the death. The continued presence and use of memorialized profiles is a matter of impersonal trust between the LC and Facebook, which is evident in the account security that is achieved when a profile is memorialized. Yet active management of a postmortem profile is amatterof interpersonal trust among the AH’s network. The translation from one form of trust to another upon a person’s death, or the representation of one form of trust within another, is an extreme scenario that highlights a sociotechnical gap [4]. That is to say, we know what needs to be built—a system that effectively conveys a trusting relationship within a useful functionality and affords actions that are true to the expectations of those in the relationship—there is no single, clear way to build it. System designers should pay attention to the ways people violate impersonal trust

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:21

Fig. 5. Interpersonal trust relies on interaction Fig. 6. Managing postmortem profiles involves and open-endedness. Postmortem scenarios carrying out unspecified responsibilities that may present challenges as interaction with the not be permitted. In these cases, impersonal trust account holder is no longer possible. is prioritized over interpersonal trust. and view people’s workarounds not as “hacks” but as indicators of where the system could better accommodate interpersonal trust-related needs of postmortem profile managers.

6.2 Workarounds as an Exercise of Trust With an understanding of how mistranslated trust is shaping LCs’ experiences, the present challenge is how to improve that translation. This is a significant challenge; after all, how can an impersonal system facilitate trust between people, which we know requires regular communication and adaptation, when one of those people is dead? As interpersonal trust relies on real-time interaction [18] and open-endedness [24], postmortem scenarios present obvious difficulty—interaction with the trusting party is no longer possible. Offline, when formalized wishes fail to meet the needs of the bereaved, people may appeal to social workers, executors, or even the judicial system for flex- ibility. Online, the inability to make changes to settings postmortem means that account holders’ trust in their designated manager may now only be enacted within a limited, impersonal system. To communicate a more appropriate level of trust, postmortem management systems could have a streamlined appeals process to expand the appropriate person’s capabilities beyond preset access or permissions. Recall that the experiences of active LCs we have shared are predominated by self-selection. Twenty of our participants circumvented the intended process of setting up Legacy Contact by accessing the deceased user’s account and choosing themselves, then memorializing that account. Each of these participants indicated reasons that their selection was appropriate, despite it not being the AH’s choice. Following account memorialization, LCs encountered personal and social expectations based on the particular memorial practices in which they and the AH’s network wanted to engage. Our participants often found their management options to be too limited or that they did not understand the options well enough to act without consulting others. In severe cases, participants reported negative emotions and negative social interactions when a lack of access to the AH’s preferences prevented actions that they felt were necessary. Overall, LCs who had negative experiences reported that a lack of granular controls feels like a betrayal of the trust LCs feel entitled to. This represents a difficult design tension: enabling the nuances of human trust would involve either granting access to the AH’s settings or creating more settings for the LC, while previous work states that so many options can negatively overload a grieving person with obligations [8]. Especially in our stress cases, LCs felt a variety of obligations

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:22 K. Z. Gach and J. R. Brubaker to the memorial profile despite their lack of options. One solution may be adding instructions or descriptions in the Help Center, particularly about what the participants in stress cases were seeking: notifications and curation. In any case, more information or controls may not be a complete solution. Behind their requests for more control is LCs’ need for the system to trust them. Open-ended options are not a functional need, but a symbolic need for interpersonal trust, visible in our participants’ need to do “whatever.” The Legacy Contact feature was initially launched with a focus on responsibilities. In contrast, our findings show that when participants talked about what it means to be an LC, they described open- ended, ambiguous aspects of a close relationship, rather than specific responsibilities. We find that being an LC is not a delegation of responsibilities, but an expression of trust. Facebook’s Legacy Contact feature was designed to focus on relationships, and thus interpersonal aspects of trust. This is why communication practices were so primary in its initial design. Despite these efforts, Legacy Contact is beholden to the underlying infrastructure of a computer system that operates in impersonal terms, and ultimately must be secure. Security concerns expose a challenging design tension, not only in the features provided to LCs, but also in what features are even viable within the infrastructure of the platform. What may have been overlooked is the reality that people “repurpose” systems for memorialization [42]. Even when the desired memorial action is not clear or possible, people find workarounds. Facebook’s privacy and security policies explicitly prohibit signing in to someone else’s account. Thus, when a legacy contact was not designated by the AH, LCs violated Facebook TOS in order to gain the needed affordances of memorialization. It is in the limited affordances of the management feature that LCs do not feel trusted by thesystem. From the perspective of the system, such workarounds make users look adversarial. System distrust in users is understood in terms of hacking, but the unauthorized access characterized by a “hack” rings false to individuals who embody the closest relationships to the deceased AHs. So, how can we reframe these LCs’ activities as grief-laden workarounds by trustworthy users who are attempting to enact a relationship that the system cannot recognize? The open-ended trust between the AH and the LC must now be performed between Facebook and the LC. Yet in terms of preferences and controls, LCs are unable to change the account settings or preferences configured by the AH. Data systems cannot recognize the way interpersonal trust extends to unspoken things, as all instructions in computation must be explicit. In this way, postmortem data management systems may never be able to represent an adequate technical equiva- lent to human trust.

6.3 The Future of Stewarding Postmortem Data In the context of a postmortem data management system, we find that trust is operationalized in the affordances of systems that connect trusted person(s) with their loved one’s online network. Our participants described a system that does not allow them to fully enact the foundational expectations of their relationship. We find that LCs trust Facebook to be something it isnot:an adaptive intermediary between themselves and the ambiguous responsibilities left to them by the AH. Meanwhile, Facebook expects LCs to be something they are not: someone chosen by the AH with specifically communicated duties that are actually possible within the system. When we frame these interactions as mistranslated trust, we can make sense of the data that shows a wide gap between what users need or expect from their role as a legacy contact and their actual management capabilities. The gap between expectations and capabilities stems not exactly from any fundamental mis- understanding of either interpersonal or impersonal trust, but from the difficulty of translating interpersonal trust into trust mediated by a system. Trusted persons are trying to perform the AH’s broadly perceived expectations within a system that does not understand or permit those

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:23 expectations. The open-endedness of an AH’s expectations does not survive the translation process. In other contexts, researchers have found that to engender trust, “systems should ... defer decision making to the user particularly when that user has the expertise or competency to be able to make as good a decision as the system or better” [24, p, 332]. Software products are designed to rely on some level of user expertise or competency, yet our participants rarely displayed a compre- hensive understanding of Legacy Contact’s capabilities. The interpersonal trust between AHs and LCs had a strong influence on LCs’ expectations, more so than practical knowledge of the system. Such expectations suggest that postmortem systems should be designed to clarify the entrusted person’s postmortem capabilities during the setup process. In Legacy Contact, this means ensuring that AHs know what to communicate to their chosen LC. For other social media platforms, adopting a similar set of premortem configurations for a postmortem data manager should contain communication prompts outlining specific permissions. For Twitter, this could mean allowing or preventing all but certain past tweets to be deleted. For LinkedIn profiles, this could mean hiding detailed work histories while preserving the availability of public references the deceased wrote for others. Ensuring a clear understanding of the specific capabilities of a system would also benefit those who, like many of our participants, select themselves to steward the AH’s profile. Recall the finding in which LCs express a desire for functionality along with a reluctance toever use that functionality. This seemingly contradictory desire demonstrates that what postmortem data managers truly want is for the system to display a core element of interpersonal trust: vulnerability. Vulnerability in this sense would involve the system exposing itself to risk at the hands of the user. These risks include actions that would have distressing consequences for people who are using their loved one’s memorialized profile for various online grief practices (e.g., Whatif the LC deletes someone else’s favorite photo of the AH? What if a postmortem Twitter manager has deleted the last “happy birthday” tweet one received from the deceased?). One way to mit- igate such risks is through social translucence, which imagines systems that support visibility, awareness, and accountability [14]. Supporting social translucence is a matter of exposing certain aspects of user behavior to other users. An incorporation of social translucence could inform the design of postmortem data management but prompts questions of to whom might those managers be accountable. The current Legacy Contact setup process does contain an aspect of accountability, but only between the LC and the AH. For future systems to allow accountability would mean making it possible to expose one’s actions to another. The predominance of self-selection among active LCs suggests that accountability of the trusted person should include the AH’s larger network. Other systems, including the future of Legacy Contact, may meet this need by making the postmortem manager’s identity or actions visible to those connected to the memorialized profile. Our participants reported difficulties when the postmortem management system didnot align with their expectations, which indicates that some elements of interpersonal trust are lost in translation to impersonal system security. While vulnerability, for example, is an essential element of interpersonal trust, system vulnerability is a negative term, something that engineers work to prevent [28]. Considering the valid and necessary concerns of active account and data security, we present three considerations for designers of postmortem management systems in the context of user needs that stem from interpersonal trust:

(1) What would it look like to design systems that are both heritable and secure without preplanning by an account holder? (2) What would it look like to acknowledge the digital heirs circumventing a process or system as nonadversarial and build for them? (3) How might we design account management in ways that acknowledge that people die, and with respect for the vulnerability and expectations within the interpersonal relationships of their real lives? ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:24 K. Z. Gach and J. R. Brubaker

7 CONCLUSION Asking a friend or loved one to care for your affairs, your family, or your data is an act of trust. However, the interpersonal form of trust with which people make these requests presents challenges for systems that conceptualize trust in impersonal terms. We found that interpersonal trust is the foundation for how people make decisions regarding postmortem profile management. In this article, we forwarded a contextual definition of postmortem trust in HCIas the assignment of managing ambiguity to an individual who is perceived to be capable of balancing the values and priorities of the deceased with the needs of the deceased’s social network. This definition roots our understanding of trust in HCI in the open-endedness of trust in human relationships, while acknowledging the necessity of specifying a person and his or her responsibilities within a system. We suggest that the designs of postmortem data management systems attempt to better translate open-ended interpersonal trust into systems that primarily understand explicit impersonal trust. Our case study focused on Facebook’s Legacy Contact, which was built based on thorough research that informed designers of what postmortem managers would need to do. Yet we found that participants did not discuss actions as much as their open-ended expectations. In this regard, simply adding functionalities would never do enough, and possibly never could. As further research expands our understanding of the experiences of people managing postmortem data, it is clear at the present time that declaring the relationship between account holder and postmortem manager is only one part of what must be accomplished. The primary finding of this study isin how the reciprocal and open-ended nature of interpersonal trust revealed cracks in a system based on impersonal trust. In our field’s ongoing work to improve how humans interact with computers and each other, postmortem data management systems can stand as critical stress cases. If the overall goal of HCI research is to improve how humans and technologies interact in all situations, we must begin with situations where compassion is most necessary. Online grief practices fit the description. The experiences of legacy contacts as described here can inform the creation of future systems that allow people to enact trust in their relationships with all of the open-endedness that it truly contains. It may seem that no matter what we build in this space, it will not be adequate. After all, how can we design for a reciprocal relationship in which one party has died and can no longer interact? Postmortem data management and the facilitation of online grief practices will be a persistent challenge. As this research community works to create systems that are able to accommodate, or even express, such things as human as trust, overall experiences of human-computer interaction can only improve.

ACKNOWLEDGMENTS Illustrations (Figures 1 to 6) by Kara Fellows. The authors would like to thank our participants for their honesty, curiosity, and beautiful stories of their departed loved ones. This work was made possible, in part, through support from Facebook, Inc. We also thank Vanessa Callison-Burch and the Memorialization Team, the Identity Lab and HCC community at CU Boulder, Kyle Gach, Aaron Jiang, Jay Gengelbach, and Lin-Manuel Miranda.

REFERENCES [1] 1Password Support Forum. 2016. My Brother Died. Can Family Access his 1password? [2] DeadSocial.org Resources & Tutorials. 2017. Retrieved from http://deadsocial.org/resources. [3] Alfarez Abdul-Rahman and Stephen Hailes. 2000. Supporting trust in virtual communities. Proceedings of the 33rd Hawaii International Conference on System Sciences 6 (2000), 1–9. DOI:https://doi.org/10.1109/HICSS.2000. 926814 [4] Mark S. Ackerman. 2000. The intellectual challenge of CSCW: The gap between social requirements and technical fea- sibility. Human-Computer Interaction 15, 2–3 (Sept. 2000), 179–203. DOI:https://doi.org/10.1207/S15327051HCI1523_5

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. Experiences of Trust in Postmortem Profile Management 2:25

[5] Jeremy Birnholtz, Jamie Guillory, Jeff Hancock, and Natalya Bazarova. 2010. “On my way”: Deceptive texting and interpersonal awareness narratives. In Proceedings of the 2010 ACM Conference on Computer Supported Cooperative Work (CSCW’10). ACM Press, New York, NY, 1. DOI:https://doi.org/10.1145/1718918.1718920 [6] Amanda Bouc, Soo-Hye Han, and Natalie Pennington. 2016. “Why are they commenting on his page?”: Using Face- book profile pages to continue connections with the deceased. Computers in Human Behavior 62 (Sept. 2016), 635–643. DOI:https://doi.org/10.1016/j.chb.2016.04.027 [7] Virginia Braun and Victoria Clarke. 2006. Using thematic analysis in psychology. Qualitative Research in Psychology 3, 2 (2006), 77–101. [8] Jed R. Brubaker and Vanessa Callison-Burch. 2016. Legacy contact: Designing and implementing post-mortem stewardship at Facebook. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems (CHI’16). Association for Computing Machinery, New York, NY, USA, 2908–2919. DOI:https://doi.org/10.1145/2858036.2858254 [9] Jed R. Brubaker, Lynn S. Dombrowski, Anita M. Gilbert, Nafiri Kusumakaulika, and Gillian R. Hayes. 2014. Stewarding a legacy: Responsibilities and relationships in the management of post-mortem data. In Proceedingsofthe32ndAnnual ACM Conference on Human Factors in Computing Systems (CHI’14), 4157–4166. DOI:https://doi.org/10.1145/2556288. 2557059 [10] Jed R. Brubaker, Gillian R. Hayes, and Paul Dourish. 2013. Beyond the grave: Facebook as a site for the expansion of death and mourning. Information Society 29 (2013), 152–163. DOI:https://doi.org/10.1080/01972243.2013.777300 [11] Brian Carroll and Katie Landry. 2010. Logging on and letting out: Using online social networks to grieve and to mourn. Bulletin of Science, Technology & Society 30, 5 (2010). DOI:https://doi.org/10.1177/0270467610380006 [12] Kathy Charmaz. 2006. Constructing Grounded Theory: A Practical Guide Through Qualitative Analysis. DOI:https:// doi.org/10.1016/j.lisr.2007.11.003 arxiv:arXiv:1011.1669v3 [13] Jocelyn M. DeGroot. 2018. A model of transcorporeal communication: Communication toward/with/to the deceased. OMEGA-Journal of Death and Dying 78, 1 (2018), 43–66. [14] Thomas Erickson and Wendy A. Kellogg. 2000. Social translucence: An approach to designing systems that support social processes. ACM Transactions on Computer-Human Interaction 7, 1 (March 2000), 59–83. DOI:https://doi.org/10. 1145/344949.345004 [15] Facebook. 2018. What Is a Legacy Contact and What Can They Do? Retrieved from https://www.facebook.com/help/ 1568013990080948 [16] Geoffrey A. Fowler. 2012. When the Most Personal Secrets Get Outed on Facebook. Retrieved from https://www.wsj. com/articles/SB10000872396390444165804578008740578200224 [17] Emily Getty, Jessica Cobb, Meryl Gabeler, Christine Nelson, Ellis Weng, and Jeffrey Hancock. 2011. I said your name in an empty room. In Proceedings of the 2011 Annual Conference on Human Factors in Computing Systems (CHI’11). ACM Press, New York, NY, 997. DOI:https://doi.org/10.1145/1978942.1979091 [18] Steve Greenspan, David Goldberg, David Weimer, and Andrea Basso. 2000. Interpersonal trust and common ground in electronically mediated communication. In Proceedings of the 2000 ACM Conference on Computer Supported Coop- erative Work (CSCW’00). ACM Press, New York, NY, 251–260. DOI:https://doi.org/10.1145/358916.358996 [19] Charles Handy. 1995. Trust and the virtual organization. Harvard Business Review May-June Issue. Retrieved from https://hbr.org/1995/05/trust-and-the-virtual-organization. [20] Amanda Holpuch. 2015. Facebook Adjusts Controversial “Real Name” Policy in Wake of Criticism. Retrieved from https://www.theguardian.com/us-news/2015/dec/15/facebook-change-controversial-real-name-policy. [21] Markus Jakobsson. 2016. User trust assessment. In Proceedings of the 6th Workshop on Socio-Technical Aspects in Se- curity and Trust (STAST’16). ACM Press, New York, NY, 73–78. DOI:https://doi.org/10.1145/3046055.3046063 [22] Tiffany Hyun-Jin Kim. 2014. Challenges of establishing trust in online entities and beyond.In Proceedings of the 4th International Workshop on Trustworthy Embedded Devices (TrustED’14). ACM Press, New York, NY, 49. DOI:https:// doi.org/10.1145/2666141.2668385 [23] Bran Knowles, Mike Harding, Lynne Blair, Nigel Davies, James Hannon, Mark Rouncefield, and John Walden. 2014. Trustworthy by design. In Proceedings of the ACM Conference on Computer Supported Cooperative Work (CSCW’14), 1060–1071. DOI:https://doi.org/10.1145/2531602.2531699 [24] Bran Knowles, Mark Rouncefield, Mike Harding, Nigel Davies, Lynne Blair, James Hannon, John Walden, andDing Wang. 2015. Models and patterns of trust. In Proceedings of the 18th ACM Conference on Computer Supported Coopera- tive Work & Social Computing (CSCW’15). ACM Press, New York, NY, 328–338. DOI:https://doi.org/10.1145/2675133. 2675154 [25] Nancy K. Lankton and D. Harrison McKnight. 2011. What does it mean to trust facebook? ACM SIGMIS Database 42, 2 (2011), 32. DOI:https://doi.org/10.1145/1989098.1989101 [26] Xiaoming Li, Qing Yang, Xiaodong Lin, Shaoen Wu, and Mike Wittie. 2016. Itrust: Interpersonal trust measurements from social interactions. IEEE Network 30, 4 (July 2016), 54–58. DOI:https://doi.org/10.1109/MNET.2016.7513864

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020. 2:26 K. Z. Gach and J. R. Brubaker

[27] Jessa Lingel. 2013. The digital remains: Social media and practices of online grief. Information Society 29, 3 (2013), 109–195. DOI:https://doi.org/10.1080/01972243.2013.777311 [28] Michael E. Locasto, Michael Massimi, and Peter J. DePasquale. 2011. Security and privacy considerations in digital death. Proceedings of the 2011 Workshop on New Security Paradigms Workshop (NSPW’11),1.DOI:https://doi.org/10. 1145/2073276.2073278 [29] Lela P. Love and Stewart E. Sterk. 2008. Leaving more than money: Mediation clauses in estate planning documents. Washington & Lee Law Review 65 (2008), 539. [30] Alice Marwick and danah m. boyd. 2011. To see and be seen: Celebrity practice on Twitter. Convergence: The In- ternational Journal of Research into New Media Technologies 17, 2 (May 2011), 139–158. DOI:https://doi.org/10.1177/ 1354856510394539 [31] Michael Massimi and Andrea Charise. 2009. Dying, death, and mortality: Towards thanatosensitivity in HCI. In Pro- ceedings of the 27th International Conference Extended Abstracts on Human Factors in Computing Systems (CHI EA’09). ACM Press, New York, NY, 2459. DOI:https://doi.org/10.1145/1520340.1520349 [32] Eric Meyer and Sara Wachter-Boettcher. 2016. Design for Real Life. A Book Apart. 132 pages. Retrieved from https://abookapart.com/products/design-for-real-life. [33] Stephan Micklitz, Martin Ortlieb, and Jessica Staddon. 2013. “I hereby leave my email to ...”:Datausagecontroland the digital estate. In 2013 IEEE Security and Privacy Workshops. IEEE, 42–44. DOI:https://doi.org/10.1109/SPW.2013.28 [34] Wendy Moncur and David Kirk. 2014. An emergent framework for digital memorials. In Proceedings of the 2014 Conference on Designing Interactive Systems (DIS’14), 965–974. DOI:https://doi.org/10.1145/2598510.2598516 [35] Joji Mori, Martin Gibbs, Michael Arnold, Bjorn Nansen, and Tamara Kohn. 2012. Design considerations for after death. In Proceedings of the 24th Australian Computer-Human Interaction Conference on (OzCHI’12). 395–404. DOI:https:// doi.org/10.1145/2414536.2414599 [36] Craig Mundie, Pierre de Vries, Peter Haynes, and Matt Corwine. 2002. Trustworthy Computing. Technical Report. Microsoft Corp., 2002. Retrieved from http://www.microsoft.com. [37] Elena Rocco. 1998. Trust breaks down in electronic contexts but can be repaired by some initial face-to-face contact. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI’98). ACM Press, New York, NY, 496–502. DOI:https://doi.org/10.1145/274644.274711 [38] Bryan Semaan and Gloria Mark. 2011. Creating a context of trust with ICTs: Restoring a sense of normalcy in the environment. In Proceedings of the ACM 2011 Conference on Computer Supported Cooperative Work (CSCW’11). 255– 264. DOI:https://doi.org/10.1145/1958824.1958863 [39] Carla J. Sofka. 2017. The role of digital and social media in supporting bereaved students. In Supporting Bereaved Students at School, Jacqueline A. Brown and Shane R. Jimerson (Eds.). Oxford University Press, Chapter 8. [40] Steven W. Thrasher. 2016. The Death of a Friend Is Always Hard. What if You Find Out on Facebook? Retrieved from https://www.theguardian.com/commentisfree/2016/may/24/death-mourning-facebook-social-media-etiquette. [41] Tony Walter. 2015. New mourners, old mourners: Online memorial culture as a chapter in the history of mourning. New Review of Hypermedia and Multimedia 21, 1–2 (2015), 10–24. [42] Tony Walter, Rachid Hourizi, Wendy Moncur, and Stacey Pitsillides. 2012. Does the internet change how we die and mourn? Overview and analysis. OMEGA-Journal of Death and Dying 64, 4 (2012), 275–302. [43] Amy X. Zhang, Martin Robbins, Ed Bice, Sandro Hawke, David Karger, An Xiao Mina, Aditya Ranganathan, Sarah Emlen Metz, Scott Appling, Connie Moon Sehat, Norman Gilmore, Nick B. Adams, Emmanuel Vincent, and Jen- nifer Lee. 2018. A structured response to misinformation. In Companion of the the Web Conference 2018 on the Web Conference 2018 (WWW’18). ACM Press, New York, NY, 603–612. DOI:https://doi.org/10.1145/3184558.3188731

Received April 2019; revised July 2019; accepted October 2019

ACM Transactions on Social Computing, Vol. 3, No. 1, Article 2. Publication date: February 2020.